diff -Naurp --exclude-from=/home/con/kernel/dontdiff linux-2.6.11-ck8/arch/ppc64/kernel/pSeries_iommu.c linux-2.6.11-ck9/arch/ppc64/kernel/pSeries_iommu.c
--- linux-2.6.11-ck8/arch/ppc64/kernel/pSeries_iommu.c	2005-03-02 19:30:25.000000000 +1100
+++ linux-2.6.11-ck9/arch/ppc64/kernel/pSeries_iommu.c	2005-05-28 20:00:01.000000000 +1000
@@ -401,6 +401,8 @@ static void iommu_bus_setup_pSeriesLP(st
 	struct device_node *dn, *pdn;
 	unsigned int *dma_window = NULL;
 
+	DBG("iommu_bus_setup_pSeriesLP, bus %p, bus->self %p\n", bus, bus->self);
+
 	dn = pci_bus_to_OF_node(bus);
 
 	/* Find nearest ibm,dma-window, walking up the device tree */
@@ -455,6 +457,56 @@ static void iommu_dev_setup_pSeries(stru
 	}
 }
 
+static void iommu_dev_setup_pSeriesLP(struct pci_dev *dev)
+{
+	struct device_node *pdn, *dn;
+	struct iommu_table *tbl;
+	int *dma_window = NULL;
+
+	DBG("iommu_dev_setup_pSeriesLP, dev %p (%s)\n", dev, dev->pretty_name);
+
+	/* dev setup for LPAR is a little tricky, since the device tree might
+	 * contain the dma-window properties per-device and not neccesarily
+	 * for the bus. So we need to search upwards in the tree until we
+	 * either hit a dma-window property, OR find a parent with a table
+	 * already allocated.
+	 */
+	dn = pci_device_to_OF_node(dev);
+
+	for (pdn = dn; pdn && !pdn->iommu_table; pdn = pdn->parent) {
+		dma_window = (unsigned int *)get_property(pdn, "ibm,dma-window", NULL);
+		if (dma_window)
+			break;
+	}
+
+	/* Check for parent == NULL so we don't try to setup the empty EADS
+	 * slots on POWER4 machines.
+	 */
+	if (dma_window == NULL || pdn->parent == NULL) {
+		/* Fall back to regular (non-LPAR) dev setup */
+		DBG("No dma window for device, falling back to regular setup\n");
+		iommu_dev_setup_pSeries(dev);
+		return;
+	} else {
+		DBG("Found DMA window, allocating table\n");
+	}
+
+	if (!pdn->iommu_table) {
+		/* iommu_table_setparms_lpar needs bussubno. */
+		pdn->bussubno = pdn->phb->bus->number;
+
+		tbl = (struct iommu_table *)kmalloc(sizeof(struct iommu_table),
+						    GFP_KERNEL);
+
+		iommu_table_setparms_lpar(pdn->phb, pdn, tbl, dma_window);
+
+		pdn->iommu_table = iommu_init_table(tbl);
+	}
+
+	if (pdn != dn)
+		dn->iommu_table = pdn->iommu_table;
+}
+
 static void iommu_bus_setup_null(struct pci_bus *b) { }
 static void iommu_dev_setup_null(struct pci_dev *d) { }
 
@@ -479,13 +531,14 @@ void iommu_init_early_pSeries(void)
 			ppc_md.tce_free	 = tce_free_pSeriesLP;
 		}
 		ppc_md.iommu_bus_setup = iommu_bus_setup_pSeriesLP;
+		ppc_md.iommu_dev_setup = iommu_dev_setup_pSeriesLP;
 	} else {
 		ppc_md.tce_build = tce_build_pSeries;
 		ppc_md.tce_free  = tce_free_pSeries;
 		ppc_md.iommu_bus_setup = iommu_bus_setup_pSeries;
+		ppc_md.iommu_dev_setup = iommu_dev_setup_pSeries;
 	}
 
-	ppc_md.iommu_dev_setup = iommu_dev_setup_pSeries;
 
 	pci_iommu_init();
 }
diff -Naurp --exclude-from=/home/con/kernel/dontdiff linux-2.6.11-ck8/arch/x86_64/kernel/ptrace.c linux-2.6.11-ck9/arch/x86_64/kernel/ptrace.c
--- linux-2.6.11-ck8/arch/x86_64/kernel/ptrace.c	2005-03-02 19:30:25.000000000 +1100
+++ linux-2.6.11-ck9/arch/x86_64/kernel/ptrace.c	2005-05-28 20:00:01.000000000 +1000
@@ -129,13 +129,13 @@ static int putreg(struct task_struct *ch
 			value &= 0xffff;
 			return 0;
 		case offsetof(struct user_regs_struct,fs_base):
-			if (!((value >> 48) == 0 || (value >> 48) == 0xffff))
-				return -EIO; 
+			if (value >= TASK_SIZE)
+				return -EIO;
 			child->thread.fs = value;
 			return 0;
 		case offsetof(struct user_regs_struct,gs_base):
-			if (!((value >> 48) == 0 || (value >> 48) == 0xffff))
-				return -EIO; 
+			if (value >= TASK_SIZE)
+				return -EIO;
 			child->thread.gs = value;
 			return 0;
 		case offsetof(struct user_regs_struct, eflags):
@@ -149,6 +149,11 @@ static int putreg(struct task_struct *ch
 				return -EIO;
 			value &= 0xffff;
 			break;
+		case offsetof(struct user_regs_struct, rip):
+			/* Check if the new RIP address is canonical */
+			if (value >= TASK_SIZE)
+				return -EIO;
+			break;
 	}
 	put_stack_long(child, regno - sizeof(struct pt_regs), value);
 	return 0;
diff -Naurp --exclude-from=/home/con/kernel/dontdiff linux-2.6.11-ck8/arch/x86_64/mm/fault.c linux-2.6.11-ck9/arch/x86_64/mm/fault.c
--- linux-2.6.11-ck8/arch/x86_64/mm/fault.c	2005-03-02 19:30:25.000000000 +1100
+++ linux-2.6.11-ck9/arch/x86_64/mm/fault.c	2005-05-28 20:00:01.000000000 +1000
@@ -236,6 +236,8 @@ static noinline void pgtable_bad(unsigne
 
 /*
  * Handle a fault on the vmalloc or module mapping area
+ *
+ * This assumes no large pages in there.
  */
 static int vmalloc_fault(unsigned long address)
 {
@@ -274,7 +276,10 @@ static int vmalloc_fault(unsigned long a
 	if (!pte_present(*pte_ref))
 		return -1;
 	pte = pte_offset_kernel(pmd, address);
-	if (!pte_present(*pte) || pte_page(*pte) != pte_page(*pte_ref))
+	/* Don't use pte_page here, because the mappings can point
+	   outside mem_map, and the NUMA hash lookup cannot handle
+	   that. */
+	if (!pte_present(*pte) || pte_pfn(*pte) != pte_pfn(*pte_ref))
 		BUG();
 	__flush_tlb_all();
 	return 0;
@@ -348,7 +353,9 @@ asmlinkage void do_page_fault(struct pt_
 	 * protection error (error_code & 1) == 0.
 	 */
 	if (unlikely(address >= TASK_SIZE)) {
-		if (!(error_code & 5)) {
+		if (!(error_code & 5) &&
+		      ((address >= VMALLOC_START && address < VMALLOC_END) ||
+		       (address >= MODULES_VADDR && address < MODULES_END))) {
 			if (vmalloc_fault(address) < 0)
 				goto bad_area_nosemaphore;
 			return;
diff -Naurp --exclude-from=/home/con/kernel/dontdiff linux-2.6.11-ck8/arch/x86_64/mm/ioremap.c linux-2.6.11-ck9/arch/x86_64/mm/ioremap.c
--- linux-2.6.11-ck8/arch/x86_64/mm/ioremap.c	2005-03-02 19:30:25.000000000 +1100
+++ linux-2.6.11-ck9/arch/x86_64/mm/ioremap.c	2005-05-28 20:00:01.000000000 +1000
@@ -266,7 +266,7 @@ void iounmap(volatile void __iomem *addr
 	if ((p->flags >> 20) &&
 		p->phys_addr + p->size - 1 < virt_to_phys(high_memory)) {
 		/* p->size includes the guard page, but cpa doesn't like that */
-		change_page_attr(virt_to_page(__va(p->phys_addr)),
+		change_page_attr_addr((unsigned long)(__va(p->phys_addr)),
 				 (p->size - PAGE_SIZE) >> PAGE_SHIFT,
 				 PAGE_KERNEL); 				 
 		global_flush_tlb();
diff -Naurp --exclude-from=/home/con/kernel/dontdiff linux-2.6.11-ck8/drivers/block/ioctl.c linux-2.6.11-ck9/drivers/block/ioctl.c
--- linux-2.6.11-ck8/drivers/block/ioctl.c	2005-03-02 19:30:25.000000000 +1100
+++ linux-2.6.11-ck9/drivers/block/ioctl.c	2005-05-28 20:00:01.000000000 +1000
@@ -237,3 +237,5 @@ long compat_blkdev_ioctl(struct file *fi
 	}
 	return ret;
 }
+
+EXPORT_SYMBOL_GPL(blkdev_ioctl);
diff -Naurp --exclude-from=/home/con/kernel/dontdiff linux-2.6.11-ck8/drivers/block/pktcdvd.c linux-2.6.11-ck9/drivers/block/pktcdvd.c
--- linux-2.6.11-ck8/drivers/block/pktcdvd.c	2005-03-02 19:30:25.000000000 +1100
+++ linux-2.6.11-ck9/drivers/block/pktcdvd.c	2005-05-28 20:00:01.000000000 +1000
@@ -2400,7 +2400,7 @@ static int pkt_ioctl(struct inode *inode
 	case CDROM_LAST_WRITTEN:
 	case CDROM_SEND_PACKET:
 	case SCSI_IOCTL_SEND_COMMAND:
-		return ioctl_by_bdev(pd->bdev, cmd, arg);
+		return blkdev_ioctl(pd->bdev->bd_inode, file, cmd, arg);
 
 	case CDROMEJECT:
 		/*
@@ -2408,7 +2408,7 @@ static int pkt_ioctl(struct inode *inode
 		 * have to unlock it or else the eject command fails.
 		 */
 		pkt_lock_door(pd, 0);
-		return ioctl_by_bdev(pd->bdev, cmd, arg);
+		return blkdev_ioctl(pd->bdev->bd_inode, file, cmd, arg);
 
 	default:
 		printk("pktcdvd: Unknown ioctl for %s (%x)\n", pd->name, cmd);
diff -Naurp --exclude-from=/home/con/kernel/dontdiff linux-2.6.11-ck8/drivers/char/raw.c linux-2.6.11-ck9/drivers/char/raw.c
--- linux-2.6.11-ck8/drivers/char/raw.c	2004-08-15 14:08:06.000000000 +1000
+++ linux-2.6.11-ck9/drivers/char/raw.c	2005-05-28 20:00:01.000000000 +1000
@@ -122,7 +122,7 @@ raw_ioctl(struct inode *inode, struct fi
 {
 	struct block_device *bdev = filp->private_data;
 
-	return ioctl_by_bdev(bdev, command, arg);
+	return blkdev_ioctl(bdev->bd_inode, filp, command, arg);
 }
 
 static void bind_device(struct raw_config_request *rq)
diff -Naurp --exclude-from=/home/con/kernel/dontdiff linux-2.6.11-ck8/drivers/ide/ide-disk.c linux-2.6.11-ck9/drivers/ide/ide-disk.c
--- linux-2.6.11-ck8/drivers/ide/ide-disk.c	2005-03-02 19:30:25.000000000 +1100
+++ linux-2.6.11-ck9/drivers/ide/ide-disk.c	2005-05-28 20:00:01.000000000 +1000
@@ -133,6 +133,8 @@ static ide_startstop_t __ide_do_rw_disk(
 	if (hwif->no_lba48_dma && lba48 && dma) {
 		if (block + rq->nr_sectors > 1ULL << 28)
 			dma = 0;
+		else
+			lba48 = 0;
 	}
 
 	if (!dma) {
@@ -146,7 +148,7 @@ static ide_startstop_t __ide_do_rw_disk(
 	/* FIXME: SELECT_MASK(drive, 0) ? */
 
 	if (drive->select.b.lba) {
-		if (drive->addressing == 1) {
+		if (lba48) {
 			task_ioreg_t tasklets[10];
 
 			pr_debug("%s: LBA=0x%012llx\n", drive->name, block);
diff -Naurp --exclude-from=/home/con/kernel/dontdiff linux-2.6.11-ck8/drivers/net/3c59x.c linux-2.6.11-ck9/drivers/net/3c59x.c
--- linux-2.6.11-ck8/drivers/net/3c59x.c	2005-03-02 19:30:26.000000000 +1100
+++ linux-2.6.11-ck9/drivers/net/3c59x.c	2005-05-28 20:00:01.000000000 +1000
@@ -1581,7 +1581,8 @@ vortex_up(struct net_device *dev)
 
 	if (VORTEX_PCI(vp)) {
 		pci_set_power_state(VORTEX_PCI(vp), PCI_D0);	/* Go active */
-		pci_restore_state(VORTEX_PCI(vp));
+		if (vp->pm_state_valid)
+			pci_restore_state(VORTEX_PCI(vp));
 		pci_enable_device(VORTEX_PCI(vp));
 	}
 
@@ -2741,6 +2742,7 @@ vortex_down(struct net_device *dev, int 
 		outl(0, ioaddr + DownListPtr);
 
 	if (final_down && VORTEX_PCI(vp)) {
+		vp->pm_state_valid = 1;
 		pci_save_state(VORTEX_PCI(vp));
 		acpi_set_WOL(dev);
 	}
@@ -3243,9 +3245,10 @@ static void acpi_set_WOL(struct net_devi
 		outw(RxEnable, ioaddr + EL3_CMD);
 
 		pci_enable_wake(VORTEX_PCI(vp), 0, 1);
+
+		/* Change the power state to D3; RxEnable doesn't take effect. */
+		pci_set_power_state(VORTEX_PCI(vp), PCI_D3hot);
 	}
-	/* Change the power state to D3; RxEnable doesn't take effect. */
-	pci_set_power_state(VORTEX_PCI(vp), PCI_D3hot);
 }
 
 
diff -Naurp --exclude-from=/home/con/kernel/dontdiff linux-2.6.11-ck8/drivers/usb/serial/visor.c linux-2.6.11-ck9/drivers/usb/serial/visor.c
--- linux-2.6.11-ck8/drivers/usb/serial/visor.c	2005-03-02 19:30:28.000000000 +1100
+++ linux-2.6.11-ck9/drivers/usb/serial/visor.c	2005-05-28 20:00:01.000000000 +1000
@@ -386,6 +386,7 @@ struct visor_private {
 	int bytes_in;
 	int bytes_out;
 	int outstanding_urbs;
+	int throttled;
 };
 
 /* number of outstanding urbs to prevent userspace DoS from happening */
@@ -415,6 +416,7 @@ static int visor_open (struct usb_serial
 	priv->bytes_in = 0;
 	priv->bytes_out = 0;
 	priv->outstanding_urbs = 0;
+	priv->throttled = 0;
 	spin_unlock_irqrestore(&priv->lock, flags);
 
 	/*
@@ -602,6 +604,7 @@ static void visor_read_bulk_callback (st
 	struct tty_struct *tty;
 	unsigned long flags;
 	int i;
+	int throttled;
 	int result;
 
 	dbg("%s - port %d", __FUNCTION__, port->number);
@@ -627,18 +630,21 @@ static void visor_read_bulk_callback (st
 	}
 	spin_lock_irqsave(&priv->lock, flags);
 	priv->bytes_in += urb->actual_length;
+	throttled = priv->throttled;
 	spin_unlock_irqrestore(&priv->lock, flags);
 
-	/* Continue trying to always read  */
-	usb_fill_bulk_urb (port->read_urb, port->serial->dev,
-			   usb_rcvbulkpipe(port->serial->dev,
-					   port->bulk_in_endpointAddress),
-			   port->read_urb->transfer_buffer,
-			   port->read_urb->transfer_buffer_length,
-			   visor_read_bulk_callback, port);
-	result = usb_submit_urb(port->read_urb, GFP_ATOMIC);
-	if (result)
-		dev_err(&port->dev, "%s - failed resubmitting read urb, error %d\n", __FUNCTION__, result);
+	/* Continue trying to always read if we should */
+	if (!throttled) {
+		usb_fill_bulk_urb (port->read_urb, port->serial->dev,
+				   usb_rcvbulkpipe(port->serial->dev,
+						   port->bulk_in_endpointAddress),
+				   port->read_urb->transfer_buffer,
+				   port->read_urb->transfer_buffer_length,
+				   visor_read_bulk_callback, port);
+		result = usb_submit_urb(port->read_urb, GFP_ATOMIC);
+		if (result)
+			dev_err(&port->dev, "%s - failed resubmitting read urb, error %d\n", __FUNCTION__, result);
+	}
 	return;
 }
 
@@ -683,16 +689,26 @@ exit:
 
 static void visor_throttle (struct usb_serial_port *port)
 {
+	struct visor_private *priv = usb_get_serial_port_data(port);
+	unsigned long flags;
+
 	dbg("%s - port %d", __FUNCTION__, port->number);
-	usb_kill_urb(port->read_urb);
+	spin_lock_irqsave(&priv->lock, flags);
+	priv->throttled = 1;
+	spin_unlock_irqrestore(&priv->lock, flags);
 }
 
 
 static void visor_unthrottle (struct usb_serial_port *port)
 {
+	struct visor_private *priv = usb_get_serial_port_data(port);
+	unsigned long flags;
 	int result;
 
 	dbg("%s - port %d", __FUNCTION__, port->number);
+	spin_lock_irqsave(&priv->lock, flags);
+	priv->throttled = 0;
+	spin_unlock_irqrestore(&priv->lock, flags);
 
 	port->read_urb->dev = port->serial->dev;
 	result = usb_submit_urb(port->read_urb, GFP_ATOMIC);
diff -Naurp --exclude-from=/home/con/kernel/dontdiff linux-2.6.11-ck8/drivers/video/matrox/matroxfb_accel.c linux-2.6.11-ck9/drivers/video/matrox/matroxfb_accel.c
--- linux-2.6.11-ck8/drivers/video/matrox/matroxfb_accel.c	2004-12-25 10:14:50.000000000 +1100
+++ linux-2.6.11-ck9/drivers/video/matrox/matroxfb_accel.c	2005-05-28 20:00:01.000000000 +1000
@@ -438,13 +438,21 @@ static void matroxfb_1bpp_imageblit(WPMI
 		} else if (step == 1) {
 			/* Special case for 1..8bit widths */
 			while (height--) {
-				mga_writel(mmio, 0, *chardata);
+#if defined(__BIG_ENDIAN)
+				fb_writel((*chardata) << 24, mmio.vaddr);
+#else
+				fb_writel(*chardata, mmio.vaddr);
+#endif
 				chardata++;
 			}
 		} else if (step == 2) {
 			/* Special case for 9..15bit widths */
 			while (height--) {
-				mga_writel(mmio, 0, *(u_int16_t*)chardata);
+#if defined(__BIG_ENDIAN)
+				fb_writel((*(u_int16_t*)chardata) << 16, mmio.vaddr);
+#else
+				fb_writel(*(u_int16_t*)chardata, mmio.vaddr);
+#endif
 				chardata += 2;
 			}
 		} else {
@@ -454,7 +462,7 @@ static void matroxfb_1bpp_imageblit(WPMI
 				
 				for (i = 0; i < step; i += 4) {
 					/* Hope that there are at least three readable bytes beyond the end of bitmap */
-					mga_writel(mmio, 0, get_unaligned((u_int32_t*)(chardata + i)));
+					fb_writel(get_unaligned((u_int32_t*)(chardata + i)),mmio.vaddr);
 				}
 				chardata += step;
 			}
diff -Naurp --exclude-from=/home/con/kernel/dontdiff linux-2.6.11-ck8/drivers/video/matrox/matroxfb_base.h linux-2.6.11-ck9/drivers/video/matrox/matroxfb_base.h
--- linux-2.6.11-ck8/drivers/video/matrox/matroxfb_base.h	2005-03-02 19:30:28.000000000 +1100
+++ linux-2.6.11-ck9/drivers/video/matrox/matroxfb_base.h	2005-05-28 20:00:01.000000000 +1000
@@ -170,14 +170,14 @@ static inline void mga_memcpy_toio(vaddr
 
 	if ((unsigned long)src & 3) {
 		while (len >= 4) {
-			writel(get_unaligned((u32 *)src), addr);
+			fb_writel(get_unaligned((u32 *)src), addr);
 			addr++;
 			len -= 4;
 			src += 4;
 		}
 	} else {
 		while (len >= 4) {
-			writel(*(u32 *)src, addr);
+			fb_writel(*(u32 *)src, addr);
 			addr++;
 			len -= 4;
 			src += 4;
diff -Naurp --exclude-from=/home/con/kernel/dontdiff linux-2.6.11-ck8/fs/ext3/balloc.c linux-2.6.11-ck9/fs/ext3/balloc.c
--- linux-2.6.11-ck8/fs/ext3/balloc.c	2005-03-02 19:30:28.000000000 +1100
+++ linux-2.6.11-ck9/fs/ext3/balloc.c	2005-05-28 20:00:01.000000000 +1000
@@ -268,7 +268,8 @@ void ext3_discard_reservation(struct ino
 
 	if (!rsv_is_empty(&rsv->rsv_window)) {
 		spin_lock(rsv_lock);
-		rsv_window_remove(inode->i_sb, rsv);
+		if (!rsv_is_empty(&rsv->rsv_window))
+			rsv_window_remove(inode->i_sb, rsv);
 		spin_unlock(rsv_lock);
 	}
 }
diff -Naurp --exclude-from=/home/con/kernel/dontdiff linux-2.6.11-ck8/include/asm-x86_64/processor.h linux-2.6.11-ck9/include/asm-x86_64/processor.h
--- linux-2.6.11-ck8/include/asm-x86_64/processor.h	2005-03-02 19:30:29.000000000 +1100
+++ linux-2.6.11-ck9/include/asm-x86_64/processor.h	2005-05-28 20:00:01.000000000 +1000
@@ -160,9 +160,9 @@ static inline void clear_in_cr4 (unsigne
 
 
 /*
- * User space process size. 47bits.
+ * User space process size. 47bits minus one guard page.
  */
-#define TASK_SIZE	(0x800000000000UL)
+#define TASK_SIZE	(0x800000000000UL - 4096)
 
 /* This decides where the kernel will search for a free chunk of vm
  * space during mmap's.
diff -Naurp --exclude-from=/home/con/kernel/dontdiff linux-2.6.11-ck8/include/linux/err.h linux-2.6.11-ck9/include/linux/err.h
--- linux-2.6.11-ck8/include/linux/err.h	2004-10-19 08:57:12.000000000 +1000
+++ linux-2.6.11-ck9/include/linux/err.h	2005-05-28 20:00:01.000000000 +1000
@@ -13,6 +13,8 @@
  * This should be a per-architecture thing, to allow different
  * error and pointer decisions.
  */
+#define IS_ERR_VALUE(x) unlikely((x) > (unsigned long)-1000L)
+
 static inline void *ERR_PTR(long error)
 {
 	return (void *) error;
@@ -25,7 +27,7 @@ static inline long PTR_ERR(const void *p
 
 static inline long IS_ERR(const void *ptr)
 {
-	return unlikely((unsigned long)ptr > (unsigned long)-1000L);
+	return IS_ERR_VALUE((unsigned long)ptr);
 }
 
 #endif /* _LINUX_ERR_H */
diff -Naurp --exclude-from=/home/con/kernel/dontdiff linux-2.6.11-ck8/kernel/sched.c linux-2.6.11-ck9/kernel/sched.c
--- linux-2.6.11-ck8/kernel/sched.c	2005-05-14 18:08:03.000000000 +1000
+++ linux-2.6.11-ck9/kernel/sched.c	2005-05-28 20:00:01.000000000 +1000
@@ -111,6 +111,7 @@ struct runqueue {
 	 */
 	unsigned long nr_running;
 #ifdef CONFIG_SMP
+	unsigned long prio_bias;
 	unsigned long cpu_load;
 #endif
 	unsigned long long nr_switches;
@@ -524,13 +525,51 @@ static inline void enqueue_task_head(str
 	__set_bit(p->prio, rq->bitmap);
 }
 
+#ifdef CONFIG_SMP
+static inline void inc_prio_bias(runqueue_t *rq, int prio)
+{
+	rq->prio_bias += MAX_PRIO - prio;
+}
+
+static inline void dec_prio_bias(runqueue_t *rq, int prio)
+{
+	rq->prio_bias -= MAX_PRIO - prio;
+}
+#else
+static inline void inc_prio_bias(runqueue_t *rq, int prio)
+{
+}
+
+static inline void dec_prio_bias(runqueue_t *rq, int prio)
+{
+}
+#endif
+
+static inline void inc_nr_running(task_t *p, runqueue_t *rq)
+{
+	rq->nr_running++;
+	if (rt_task(p))
+		inc_prio_bias(rq, p->prio);
+	else
+		inc_prio_bias(rq, p->static_prio);
+}
+
+static inline void dec_nr_running(task_t *p, runqueue_t *rq)
+{
+	rq->nr_running--;
+	if (rt_task(p))
+		dec_prio_bias(rq, p->prio);
+	else
+		dec_prio_bias(rq, p->static_prio);
+}
+
 /*
  * __activate_task - move a task to the runqueue.
  */
 static void __activate_task(task_t *p, runqueue_t *rq)
 {
 	enqueue_task(p, rq);
-	rq->nr_running++;
+	inc_nr_running(p, rq);
 }
 
 /*
@@ -539,7 +578,7 @@ static void __activate_task(task_t *p, r
 static inline void __activate_idle_task(task_t *p, runqueue_t *rq)
 {
 	enqueue_task_head(p, rq);
-	rq->nr_running++;
+	inc_nr_running(p, rq);
 }
 
 /*
@@ -753,7 +792,7 @@ static void activate_task(task_t *p, run
  */
 static inline void deactivate_task(struct task_struct *p, runqueue_t *rq)
 {
-	rq->nr_running--;
+	dec_nr_running(p, rq);
 	dequeue_task(p, rq);
 }
 
@@ -900,25 +939,54 @@ void kick_process(task_t *p)
  * We want to under-estimate the load of migration sources, to
  * balance conservatively.
  */
-static inline unsigned long source_load(int cpu)
+static inline unsigned long __source_load(int cpu, enum idle_type idle)
 {
 	runqueue_t *rq = cpu_rq(cpu);
-	unsigned long load_now = rq->nr_running * SCHED_LOAD_SCALE;
+	unsigned long source_load, cpu_load = rq->cpu_load,
+		load_now = rq->nr_running * SCHED_LOAD_SCALE;
+
+	source_load = min(cpu_load, load_now);
+
+	if (idle == NOT_IDLE || rq->nr_running > 1)
+		/*
+		 * If we are busy rebalancing the load is biased by
+		 * priority to create 'nice' support across cpus. When
+		 * idle rebalancing we should only bias the source_load if
+		 * there is more than one task running on that queue to
+		 * prevent idle rebalance from trying to pull tasks from a
+		 * queue with only one running task.
+		 */
+		source_load *= rq->prio_bias;
 
-	return min(rq->cpu_load, load_now);
+	return source_load;
+}
+
+static inline unsigned long source_load(int cpu)
+{
+	return __source_load(cpu, NOT_IDLE);
 }
 
 /*
  * Return a high guess at the load of a migration-target cpu
  */
-static inline unsigned long target_load(int cpu)
+static inline unsigned long __target_load(int cpu, enum idle_type idle)
 {
 	runqueue_t *rq = cpu_rq(cpu);
-	unsigned long load_now = rq->nr_running * SCHED_LOAD_SCALE;
+	unsigned long target_load, cpu_load = rq->cpu_load,
+		load_now = rq->nr_running * SCHED_LOAD_SCALE;
+
+	target_load = max(cpu_load, load_now);
+
+	if (idle == NOT_IDLE || rq->nr_running > 1)
+		target_load *= rq->prio_bias;
 
-	return max(rq->cpu_load, load_now);
+	return target_load;
 }
 
+static inline unsigned long target_load(int cpu)
+{
+	return __target_load(cpu, NOT_IDLE);
+}
 #endif
 
 /*
@@ -1556,9 +1624,9 @@ static inline void pull_task(runqueue_t 
 		runqueue_t *this_rq, int this_cpu)
 {
 	dequeue_task(p, src_rq);
-	src_rq->nr_running--;
+	dec_nr_running(p, src_rq);
 	set_task_cpu(p, this_cpu);
-	this_rq->nr_running++;
+	inc_nr_running(p, this_rq);
 	enqueue_task(p, this_rq);
 	p->timestamp = (p->timestamp - src_rq->timestamp_last_tick)
 				+ this_rq->timestamp_last_tick;
@@ -1692,9 +1760,9 @@ find_busiest_group(struct sched_domain *
 		for_each_cpu_mask(i, group->cpumask) {
 			/* Bias balancing toward cpus of our domain */
 			if (local_group)
-				load = target_load(i);
+				load = __target_load(i, idle);
 			else
-				load = source_load(i);
+				load = __source_load(i, idle);
 
 			nr_cpus++;
 			avg_load += load;
@@ -1806,14 +1874,15 @@ out_balanced:
 /*
  * find_busiest_queue - find the busiest runqueue among the cpus in group.
  */
-static runqueue_t *find_busiest_queue(struct sched_group *group)
+static runqueue_t *find_busiest_queue(struct sched_group *group,
+	enum idle_type idle)
 {
 	unsigned long load, max_load = 0;
 	runqueue_t *busiest = NULL;
 	int i;
 
 	for_each_cpu_mask(i, group->cpumask) {
-		load = source_load(i);
+		load = __source_load(i, idle);
 
 		if (load > max_load) {
 			max_load = load;
@@ -1847,7 +1916,7 @@ static inline int load_balance(int this_
 		goto out_balanced;
 	}
 
-	busiest = find_busiest_queue(group);
+	busiest = find_busiest_queue(group, idle);
 	if (!busiest) {
 		schedstat_inc(sd, lb_nobusyq[idle]);
 		goto out_balanced;
@@ -1951,7 +2020,7 @@ static inline int load_balance_newidle(i
 		goto out;
 	}
 
-	busiest = find_busiest_queue(group);
+	busiest = find_busiest_queue(group, NEWLY_IDLE);
 	if (!busiest || busiest == this_rq) {
 		schedstat_inc(sd, lb_nobusyq[NEWLY_IDLE]);
 		goto out;
@@ -3094,8 +3163,10 @@ void set_user_nice(task_t *p, long nice)
 		p->static_prio = NICE_TO_PRIO(nice);
 		goto out_unlock;
 	}
-	if ((queued = task_queued(p)))
+	if ((queued = task_queued(p))) {
 		dequeue_task(p, rq);
+		dec_prio_bias(rq, p->static_prio);
+	}
 
 	old_prio = p->prio;
 	new_prio = NICE_TO_PRIO(nice);
@@ -3105,6 +3176,7 @@ void set_user_nice(task_t *p, long nice)
 
 	if (queued) {
 		enqueue_task(p, rq);
+		inc_prio_bias(rq, p->static_prio);
 		/*
 		 * If the task increased its priority or is running and
 		 * lowered its priority, then reschedule its CPU:
diff -Naurp --exclude-from=/home/con/kernel/dontdiff linux-2.6.11-ck8/Makefile linux-2.6.11-ck9/Makefile
--- linux-2.6.11-ck8/Makefile	2005-05-14 18:08:03.000000000 +1000
+++ linux-2.6.11-ck9/Makefile	2005-05-28 20:00:01.000000000 +1000
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 11
-EXTRAVERSION = -ck8
+EXTRAVERSION = -ck9
 NAME=Cognac Woozy Numbat
 
 # *DOCUMENTATION*
diff -Naurp --exclude-from=/home/con/kernel/dontdiff linux-2.6.11-ck8/mm/mmap.c linux-2.6.11-ck9/mm/mmap.c
--- linux-2.6.11-ck8/mm/mmap.c	2005-03-02 19:30:30.000000000 +1100
+++ linux-2.6.11-ck9/mm/mmap.c	2005-05-28 20:00:01.000000000 +1000
@@ -1315,37 +1315,40 @@ unsigned long
 get_unmapped_area(struct file *file, unsigned long addr, unsigned long len,
 		unsigned long pgoff, unsigned long flags)
 {
-	if (flags & MAP_FIXED) {
-		unsigned long ret;
+	unsigned long ret;
 
-		if (addr > TASK_SIZE - len)
-			return -ENOMEM;
-		if (addr & ~PAGE_MASK)
-			return -EINVAL;
-		if (file && is_file_hugepages(file))  {
-			/*
-			 * Check if the given range is hugepage aligned, and
-			 * can be made suitable for hugepages.
-			 */
-			ret = prepare_hugepage_range(addr, len);
-		} else {
-			/*
-			 * Ensure that a normal request is not falling in a
-			 * reserved hugepage range.  For some archs like IA-64,
-			 * there is a separate region for hugepages.
-			 */
-			ret = is_hugepage_only_range(addr, len);
-		}
-		if (ret)
-			return -EINVAL;
-		return addr;
-	}
+	if (!(flags & MAP_FIXED)) {
+		unsigned long (*get_area)(struct file *, unsigned long, unsigned long, unsigned long, unsigned long);
 
-	if (file && file->f_op && file->f_op->get_unmapped_area)
-		return file->f_op->get_unmapped_area(file, addr, len,
-						pgoff, flags);
+		get_area = current->mm->get_unmapped_area;
+		if (file && file->f_op && file->f_op->get_unmapped_area)
+			get_area = file->f_op->get_unmapped_area;
+		addr = get_area(file, addr, len, pgoff, flags);
+		if (IS_ERR_VALUE(addr))
+			return addr;
+	}
 
-	return current->mm->get_unmapped_area(file, addr, len, pgoff, flags);
+	if (addr > TASK_SIZE - len)
+		return -ENOMEM;
+	if (addr & ~PAGE_MASK)
+		return -EINVAL;
+	if (file && is_file_hugepages(file))  {
+		/*
+		 * Check if the given range is hugepage aligned, and
+		 * can be made suitable for hugepages.
+		 */
+		ret = prepare_hugepage_range(addr, len);
+	} else {
+		/*
+		 * Ensure that a normal request is not falling in a
+		 * reserved hugepage range.  For some archs like IA-64,
+		 * there is a separate region for hugepages.
+		 */
+		ret = is_hugepage_only_range(addr, len);
+	}
+	if (ret)
+		return -EINVAL;
+	return addr;
 }
 
 EXPORT_SYMBOL(get_unmapped_area);
diff -Naurp --exclude-from=/home/con/kernel/dontdiff linux-2.6.11-ck8/net/bridge/netfilter/ebtables.c linux-2.6.11-ck9/net/bridge/netfilter/ebtables.c
--- linux-2.6.11-ck8/net/bridge/netfilter/ebtables.c	2005-03-02 19:30:30.000000000 +1100
+++ linux-2.6.11-ck9/net/bridge/netfilter/ebtables.c	2005-05-28 20:00:01.000000000 +1000
@@ -179,9 +179,10 @@ unsigned int ebt_do_table (unsigned int 
 	struct ebt_chainstack *cs;
 	struct ebt_entries *chaininfo;
 	char *base;
-	struct ebt_table_info *private = table->private;
+	struct ebt_table_info *private;
 
 	read_lock_bh(&table->lock);
+	private = table->private;
 	cb_base = COUNTER_BASE(private->counters, private->nentries,
 	   smp_processor_id());
 	if (private->chainstack)
diff -Naurp --exclude-from=/home/con/kernel/dontdiff linux-2.6.11-ck8/net/rose/rose_route.c linux-2.6.11-ck9/net/rose/rose_route.c
--- linux-2.6.11-ck8/net/rose/rose_route.c	2005-03-02 19:30:30.000000000 +1100
+++ linux-2.6.11-ck9/net/rose/rose_route.c	2005-05-28 20:00:01.000000000 +1000
@@ -727,7 +727,8 @@ int rose_rt_ioctl(unsigned int cmd, void
 		}
 		if (rose_route.mask > 10) /* Mask can't be more than 10 digits */
 			return -EINVAL;
-
+		if (rose_route.ndigis > 8) /* No more than 8 digipeats */
+			return -EINVAL;
 		err = rose_add_node(&rose_route, dev);
 		dev_put(dev);
 		return err;
diff -Naurp --exclude-from=/home/con/kernel/dontdiff linux-2.6.11-ck8/sound/usb/usbaudio.c linux-2.6.11-ck9/sound/usb/usbaudio.c
--- linux-2.6.11-ck8/sound/usb/usbaudio.c	2005-03-02 19:30:31.000000000 +1100
+++ linux-2.6.11-ck9/sound/usb/usbaudio.c	2005-05-28 20:00:01.000000000 +1000
@@ -3276,7 +3276,7 @@ static void snd_usb_audio_disconnect(str
 		}
 		usb_chip[chip->index] = NULL;
 		up(&register_mutex);
-		snd_card_free_in_thread(card);
+		snd_card_free(card);
 	} else {
 		up(&register_mutex);
 	}
diff -Naurp --exclude-from=/home/con/kernel/dontdiff linux-2.6.11-ck8/sound/usb/usx2y/usbusx2y.c linux-2.6.11-ck9/sound/usb/usx2y/usbusx2y.c
--- linux-2.6.11-ck8/sound/usb/usx2y/usbusx2y.c	2005-03-02 19:30:31.000000000 +1100
+++ linux-2.6.11-ck9/sound/usb/usx2y/usbusx2y.c	2005-05-28 20:00:01.000000000 +1000
@@ -1,6 +1,11 @@
 /*
  * usbusy2y.c - ALSA USB US-428 Driver
  *
+2005-04-14 Karsten Wiese
+	Version 0.8.7.2:
+	Call snd_card_free() instead of snd_card_free_in_thread() to prevent oops with dead keyboard symptom.
+	Tested ok with kernel 2.6.12-rc2.
+
 2004-12-14 Karsten Wiese
 	Version 0.8.7.1:
 	snd_pcm_open for rawusb pcm-devices now returns -EBUSY if called without rawusb's hwdep device being open.
@@ -143,7 +148,7 @@
 
 
 MODULE_AUTHOR("Karsten Wiese <annabellesgarden@yahoo.de>");
-MODULE_DESCRIPTION("TASCAM "NAME_ALLCAPS" Version 0.8.7.1");
+MODULE_DESCRIPTION("TASCAM "NAME_ALLCAPS" Version 0.8.7.2");
 MODULE_LICENSE("GPL");
 MODULE_SUPPORTED_DEVICE("{{TASCAM(0x1604), "NAME_ALLCAPS"(0x8001)(0x8005)(0x8007) }}");
 
@@ -430,8 +435,6 @@ static void usX2Y_usb_disconnect(struct 
 	if (ptr) {
 		usX2Ydev_t* usX2Y = usX2Y((snd_card_t*)ptr);
 		struct list_head* p;
-		if (usX2Y->chip_status == USX2Y_STAT_CHIP_HUP)	// on 2.6.1 kernel snd_usbmidi_disconnect()
-			return;					// calls us back. better leave :-) .
 		usX2Y->chip.shutdown = 1;
 		usX2Y->chip_status = USX2Y_STAT_CHIP_HUP;
 		usX2Y_unlinkSeq(&usX2Y->AS04);
@@ -443,7 +446,7 @@ static void usX2Y_usb_disconnect(struct 
 		}
 		if (usX2Y->us428ctls_sharedmem) 
 			wake_up(&usX2Y->us428ctls_wait_queue_head);
-		snd_card_free_in_thread((snd_card_t*)ptr);
+		snd_card_free((snd_card_t*)ptr);
 	}
 }